Who we are
This policy explains how Tamvya handles personal data on tamvya.com and in the Tamvya app. Tamvya is an individual business (sole proprietorship) based in India. Tamvya decides how and why this data is used: we are the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023, and the “controller” under laws such as the GDPR. Privacy contact: support@tamvya.com.
What we collect, why, and the legal basis
| What | Why we use it | Legal basis |
|---|---|---|
| Account: your email address and a password (stored only in hashed form by our sign-in service). With Continue with Google, Google shares your email address and basic profile. | To create your account, sign you in and send service emails (sign-in links, password resets, receipts and important changes). | Contract (to provide the service you signed up for) |
| Workspace data: your labels and their text, logos and images, barcode and QR code values, label sizes, printer settings and, on Business, your products and stock records. | To save your work, show previews and print. | Contract |
| Plan and usage: your plan, trial status, and counts such as active designs, prints, exports and AI credits used. | To apply plan limits, run free trials fairly and prevent misuse. | Contract; legitimate interests (preventing misuse) |
| Payment and billing records: whether a subscription is active, renewal dates, invoices, and payment IDs from Razorpay or Paddle. | To take payments, keep accounts and meet tax rules. | Contract; legal obligation (tax and accounting) |
| Technical data: IP address, browser type and request logs kept by our hosting and database providers. | To keep the service secure and fix problems. | Legitimate interests (security) |
| Messages: what you send us when you contact support. | To answer you and keep a record of the conversation. | Contract; legitimate interests |
Under India’s DPDP Act, we process this data with the consent you give when you create an account and use the service, or for the legitimate uses the Act allows (for example to meet a legal duty). We don’t ask for your name, business details or anything else at sign-up. We don’t sell your personal data and we don’t use your labels or products for advertising.
What stays on your device
- Spreadsheets you print from are read in your browser and aren’t uploaded or saved by us.
- Camera checks of printed labels and camera scans happen in your browser. The camera picture isn’t uploaded.
- The website’s free tools (the barcode checker and the MRP label maker) run in your browser. What you type, camera pictures, photos you choose and the PDFs you make aren’t uploaded or saved by us.
- This website reads your device’s time zone in your browser only to choose which prices to show. It isn’t sent to us.
AI drafts
When you ask for an AI draft or use the editor’s AI chat, we send OpenAI the description you typed, the list of Tamvya’s templates and, in the chat, the text and layout of your label’s boxes. Barcode and QR code values are never sent. Nothing else from your workspace is sent. Please don’t type personal or sensitive information into descriptions.
Who we share data with
We share data only with these recipients, and only so they can run parts of the service for us or because the law requires it:
- Supabase: our data host. It runs accounts, sign-in emails and the database that stores your workspaces, labels and products.
- Cloudflare: hosting of tamvya.com and the app, content delivery and security.
- OpenAI: AI drafts (only the data described above).
- Razorpay: payment processor for payments in India.
- Paddle: payment processor and Merchant of Record for orders outside India. Paddle collects your checkout details directly and uses them under its own privacy policy.
- Google: only if you choose Continue with Google.
- Professional advisers, such as accountants and lawyers, when we need their help.
- Authorities, such as tax authorities, courts or the police, when the law requires it, and others where needed to protect the service and its users from fraud or abuse.
Where data is stored
Supabase stores our database in India (Mumbai). Our other providers may process data in other countries, including outside India. We use providers that protect data with appropriate security measures, and we transfer data only as Indian law allows. Where the GDPR or a similar law applies, these transfers rely on safeguards such as the European Commission’s standard contractual clauses in our providers’ data processing terms.
Cookies and local storage
This website uses no cookies, no analytics and no advertising trackers. The Tamvya app uses your browser’s storage, not advertising or analytics cookies, to keep you signed in and to remember settings on that computer, such as your paper and printer choices. It keeps a copy of your plan for up to 24 hours so printing works on a brief connection problem, and briefly hands an AI draft to the editor in the same tab. Clearing your browser’s site data removes these. The Razorpay and Paddle checkouts may use their own cookies, needed to take a payment safely, under their own policies.
How long we keep data
- Account, workspace, label and product data: while your account is open. When you ask us to delete your account, we delete this data from our live systems within 30 days; backup copies are removed within a further 90 days.
- Billing records: as long as tax and accounting laws require (in India, up to 8 years).
- Security logs: up to 90 days, unless we need them longer to look into a problem.
- Support messages: up to 2 years after the conversation ends.
Security
We protect your data with reasonable security measures. Data is sent over encrypted connections. Each workspace’s data can only be read by its members, enforced in the database. Only a few people can access production systems, and only to run the service. No system is perfectly secure, so if we learn of a breach that affects you, we will tell you and the authorities as the law requires.
Your rights
Under India’s Digital Personal Data Protection Act, 2023, and similar laws elsewhere, you can ask us to:
- tell you what personal data we hold about you and how we use it;
- correct or update it;
- delete it (we may keep what the law requires, such as billing records);
- withdraw consent where we rely on it, for example for optional emails;
- nominate someone to act for you if you die or can’t act yourself.
Where the GDPR or a similar law applies, you can also object to processing based on legitimate interests, ask us to restrict processing, and receive a copy of your data in a portable form. To make a request, email support@tamvya.com from your account’s email address. We reply within 30 days.
Complaints: support@tamvya.com. If you’re not satisfied with our reply, you can complain to the Data Protection Board of India, or to the data protection authority where you live.
Children
Tamvya is a business tool and isn’t meant for anyone under 18. We don’t knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.
Changes to this policy
We may update this policy. If a change is important, we will tell you by email or in the app before it takes effect. The date at the top shows when it last changed.
Contact
Questions or requests about privacy: support@tamvya.com.